FIG. 1 is a block diagram of an exemplary Lawful Interception (LI) system and network 10 according to prior art. Said system and network comprises a number of entities. The exemplary LI system comprises a Law Enforcement Management Function, LEMF, 12 for requesting LI services of the LI system and collecting intercepted information of Intercepting Control Elements, ICEs, in the system. The system shall provide access to the intercepted Content of Communications, CC, and Intercept Related Information, IRI, of a target and services related to the target on behalf of one or more Law Enforcement Agencies, LEAs 80. An intercept request, also denoted Request for LI activation, is sent through a first Handover Interface, HI1, located between the Law Enforcement Management Function 12 and an Intercept Mediation and Delivery Unit, IMDU, 14 comprising a Mediation Function, MF, 16 and an Administration Function, ADMF, 18. Said Mediation Function 16 and Administration Function 18 generates based on said received request a warrant comprising said one or more target identities, and sends said warrant towards an Intercepting Control Element, ICE, 20 via an interface denoted X1_1. The ICE 20 may be connected to a node of a network, e.g. the Internet, a 3 GMS (third generation Mobile Communications System), etc., from which it intercepts said Content of Communications and Intercept Related Information of a mobile target. Said CC and IRI are network related data. As reference to the standard model, see references [1], [2] and [3], the content of communication is intercepted in the ICE network node and it is based upon duplication of target communication payload without modification. In reference [3], the interfaces HI1 and HI2 is specified in more detail. The ICE sends IRI raw data via an interface X2 to a Delivery Function for IRI reporting, DF2, 24 and a Mediation Function of IRI, MF2, 22 that generates and delivers to a collection functionality a standardized IRI report based on the received IRI report. Said standardized IRI report is sent over a standardized interface HI2 to the LEMF 12. The ICE 20 also sends CC raw data via an interface X3 to a Delivery Function for CC reporting, DF3, 26 and a Mediation Function of CC, MF3, 28 which generates and delivers to a collection functionality a standardized CC report based on the received CC report. Said standardized CC report is sent over a standardized interface HI3 to the requesting LEMF 12.
The HI2 and HI3-interfaces represent the interfaces between the LEA and two delivery functions. The delivery functions are used:                to distribute the Intercept Related Information (IRI) to the relevant LEA(s) via HI2;        to distribute the Content of Communication (CC) to the relevant LEA(s) via HI3.        
According to known internet access services, all the IP streams related to a given target is intercepted and delivered as a whole session data flow regardless any service used within an interception session.
IP Services and bandwidth offered per each subscriber is dramatically increasing.
Although in many countries the communication path between Telecom Operators and LEAs is constantly improved, the available bandwidth is still a precious resource to be carefully preserved.
Many LEAs request the operators to receive only the payload which is considered relevant for their investigations and to discard non-relevant voluminous data like P2P movies, IPTV, VOD in the operator domain.
This is usually provided by filtering out specific voluminous content in the operator domain by means of real time Deep Packet Inspection/Decoding techniques.
International press quotes more and more cases of hidden content inside data used by criminals for exchange of messages. Besides “Steganography”, a simple method might be to include piece of a self-made movie, bringing secret messages, within an ordinary movie swapped in a P2P session.
The presence of hidden messages would not be revealed when using filtering in the operator domain, not even when metadata is available.
E.g. the metadata might report:                Source IP address 192.134.0.1        Filename: “MonstersIncByPixar”. . . while, the actual content might be full of pieces of movie of other kind. If a LEA needs to access specific contents embedded in the whole session streams, it becomes necessary to do an appropriate post-processing of the intercepted data to find the data content of interest.        